1080606 - Update VLC plugin to 2.1.5

Status: RESOLVED FIXED

(Plugin Check Graveyard :: Whistler, defect, P1)

Description

[Chandra Mohan]

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36



Actual results:

Firefox is using VLC plug-in 2.1.3. Its an old version of which is having some critical security issues.


Expected results:

Videolan has fixed some critical security issues in 2.1.5, so Firefox should mark older versions as outdated or vulnerable.

Comment 1

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

Firefox does not ship with this plug-in by default. You either have to add it during vlc installation or do so manaully. Plug-in check _might_ be able to help notify users so moving this there for an answer.

Removing flag as the info is public

Comment 2

[Chandra Mohan]

Attachment: Untitled.png

Hi

Please find the attached screen shot that show VLC 2.1.3 is up-to-date for Firefox. Firefox should block these versions as out-dated.

Vulnerabilities Fixed in 2.1.4

CVE-2014-3441
CVE-2014-1684

Vulnerabilities Fixed in 2.1.5

CVE  2014-0333 
CVE  2014-3466 

Thanks
Chandra Mohan

Comment 3

[Chandra Mohan]

Attachment: AutoScreenRecorder_02 Oct. 13 17.54_x264.mp4

Hi

Please find the Video POC.

Also the security vulnerability of VLC plug-ins versions before 2.1.5 version is very high.

CVE-2014-3441 - denial of service (memory corruption)
CVE-2014-1684 - denial of service (memory corruption)
CVE 2014-0333 - denial of service (memory corruption)
CVE 2014-3466 - denial of service (memory corruption) or possibly execute     arbitrary code via a long session id in a Server Hello message.

Thanks
Chandra Mohan

Comment 4

[annhall901]

How do I get all the bugs off my phone someone else addad

Comment 5

[annhall901]

How do I get all the bugs off my phone someone else addad

Comment 6

[Schalk Neethling [:espressive]]

Plugin updated on production database.

Comment 7

[Chandra Mohan]

Hi

Thanks for the quick fix. Any bounty?

Comment 8

[Chandra Mohan]

Hey, Why no reply?

Comment 9

[Jorge Villalobos [:jorgev] (he/him)]

I'm not involved with the bug bounty program, but I'm fairly sure this report doesn't qualify, since it's a bug in a third party plugin, and the only issue was the way we presented it. You can find the rules for the program here: https://www.mozilla.org/security/bug-bounty/

Comment 10

[Chandra Mohan]

Hi

Thanks for your reply. But here the bug is in the browser plug-in check.

Comment 11

[Jorge Villalobos [:jorgev] (he/him)]

It's not really part of the browser, but a webpage that is used to assist users to update their plugins. Also, pointing to a vulnerable version of a plugin doesn't necessarily mean the user will be attacked. And the bug would be on the plugin side, not the browser side. Plugins are click-to-activate by default, as an additional protection.

I don't think this constitutes a major security problem, and the other people who have intervened in this bug seem to agree, since none of them marked it as such. We appreciate your help in filing this bug, but I don't think it qualifies for a bounty.

Comment 12

[john]

See bug 1089012